---
id: 6539
title: "CVE-2026-26119 PoC: Windows Admin Center authenticated RCE"
cve: CVE-2026-26119
cvss: 8.8
vendor: "Microsoft"
product: "Windows Admin Center"
affected_versions: "< 2.6.4"
source_domain: github.com
source_url: "https://github.com/r3vpwnx/cve-2026-26119"
published_at: "2026-08-09T20:21:00Z"
tags: ["ai-security", "rce", "public-poc", "privilege-escalation", "windows-security", "windows-admin-center", "powershell", "exploit", "cve", "poc", "reverse-shell", "cve-2026-26119", "github-com"]
phying_url: "https://phying.com/item/6539"
lang: en
---

# CVE-2026-26119 PoC: Windows Admin Center authenticated RCE

## Summary

A PoC for CVE-2026-26119, an authenticated remote code execution vulnerability in Windows Admin Center, exploiting the WinREST/PowerShell invokeCommand path with steps to obtain a reverse shell.

## Why it matters

The PoC shows that a low-privileged valid account can turn the flaw into remote command execution over the network. Upgrade to Windows Admin Center 2.6.4 or later and review WAC accounts and anomalous PowerShell activity.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-26119
- **CVSS:** 8.8
- **Vendor:** Microsoft
- **Product:** Windows Admin Center
- **Affected versions:** < 2.6.4
- **Published:** 2026-08-09T20:21:00Z
- **Original:** https://github.com/r3vpwnx/cve-2026-26119
- **Phying News:** https://phying.com/item/6539